Weaknesses of type CWE-78

5,019 results

Injeção de comandos do sistema operacional

A aplicação constrói comandos do SO usando entrada do usuário sem sanitizar adequadamente, permitindo que um atacante injete comandos arbitrários. Quando a entrada contém metacaracteres (como `|`, `;`, `&&`, backticks), o shell interpreta-os como operadores, executando código não intencional com os privilégios da aplicação.

Example

Um script PHP que executa `system('ping ' . $_GET['host'])` permite um atacante passar `127.0.0.1; rm -rf /` como parâmetro, executando deleção de arquivos. Ou em Java, `Runtime.exec()` com strings concatenadas do usuário sem validação.

How to mitigate

Use APIs que não invocam shell (ex: `execvp()` em C, arrays de parâmetros em Java/Python, ou prepared commands). Se inevitável usar shell, escape rigorosamente com funções específicas (`escapeshellarg()` em PHP) ou valide contra whitelist de caracteres permitidos. Nunca confie em blacklist de caracteres perigosos.

CVE-2019-10958—Geutebruck IP Cameras G-Code(EEC-2xxx), G-Cam(EBC-21xx/EFD-22xx/ETHC-22xx/EWPC-22xx): All versions 1.12.0.25 and prior may allow a remote auEPSS 3.3%CVE-2026-60102HIGHHorde VFS < 3.0.1 OS Command Injection via Horde_Vfs_Smb DriverEPSS 3.3%CVE-2026-69096HIGHOpenWrt luci-app-dockerman Read ACL Remote Code ExecutionEPSS 3.3%CVE-2026-7119HIGHTenda HG3 formCountrystr os command injectionEPSS 3.3%CVE-2025-3729MEDIUMSourceCodester Web-based Pharmacy Product Management System Database Backup backup.php os command injectionEPSS 3.3%CVE-2025-66212CRITICALCoolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Dynamic Proxy Configuration FilenameEPSS 3.3%CVE-2026-82004CRITICALAdobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)EPSS 3.3%CVE-2023-43482HIGHA command execution vulnerability exists in the guest resource functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322EPSS 3.3%CVE-2026-110645CRITICALVideo-stitch before 2.0.0-beta.1 OS Command Injection via concat() and cut()EPSS 3.2%CVE-2026-34234CRITICALCtrlPanel: Unauthenticated RCE using installer scriptEPSS 3.2%CVE-2025-30007HIGHHestiaCP < 1.9.5 Authenticated OS Command Injection via DNS Record ManagementEPSS 3.2%CVE-2019-1581CRITICALPAN-OS: Remote code execution vulnerability in the PAN-OS SSH device management interfaceEPSS 3.2%CVE-2024-10966MEDIUMTOTOLINK X18 cstecgi.cgi os command injectionEPSS 3.2%CVE-2026-8112MEDIUM8421bit MiniClaw kernel.ts executeCognitivePulse os command injectionEPSS 3.2%CVE-2025-8259MEDIUMVaelsys VaelsysV4 Web interface vgrid_server.php execute_DataObjectProc os command injectionEPSS 3.2%CVE-2022-22984MEDIUMCommand InjectionEPSS 3.2%CVE-2026-16445HIGHDracut: dracut: root code execution via dhcp options command injection in networkmanager initrd moduleEPSS 3.2%CVE-2026-120276CRITICALWAVLINK WN536AX6-A Web Management ioos sub_416760 os command injectionEPSS 3.2%CVE-2020-5759—Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via SSH. An authenticated remote attacEPSS 3.2%CVE-2026-41924CRITICALWDR201A WiFi Extender OS Command Injection via makeRequest.cgiEPSS 3.2%